What happens when an attacker weaponizes GitOps against you? This technical deep dive dissects the architecture of a "Git-Native" botnet that exploits CI/CD pipelines and declarative configurations to maintain cluster persistence. We will track the attack lifecycle from a compromised container to unauthorized repository commits that automatically deploy rogue workloads. Finally, we will transition to defense, demonstrating how to neutralize these threats using strict runtime security and policy enforcement to ensure a truly secure GitOps supply chain.